81e1b2f483690bf652b2072fa4f36dc4f3eebd204a2030aaf2b80ef8a10b3fde

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d61c2e5caae96b80f1feb41ddb73baa8.html
Size

48KB
MD5

d61c2e5caae96b80f1feb41ddb73baa8
SHA1

3f549b704bb52e3f0e8d5ae70064a99a5e55712c
SHA256

81e1b2f483690bf652b2072fa4f36dc4f3eebd204a2030aaf2b80ef8a10b3fde
SHA512

f77a3efeffa4f8dd355e2125b51e0ca8a06d146a5677248cfa93fe6b78fb954af95e5163860a7109e408964fd2340ca93cdcb39797dc1246d324dd768ede6b77
SSDEEP

1536:IRaBgtU+x295ycAKveGB8lAKBH+Yxo+PVFeJ/6cJsThbFG:aaBgF295ycAKveGB8CoZKsThbg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000f1cd3e772d499f36a98664e639f0089040ff2ee56aafc03ab63d7a8b853644d9000000000e8000000002000020000000a6208ead436e489ef4cd397bc3e4cb31ed65f4a2d275ae94804535a423faba9720000000a25dd304292d44a474626ebee7d5c6984a6dd3e34681eb541b5aa04ab8c0fbe34000000050d7347e81e8f83bf1481eb42d9a46a5d78c612b625a14e3a21bbc714377a079cebb77c5b28a1231c8014a35dd6bfe10aaf6f640e5d610ee72864a37dfa8fd71	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000012521ec2f4b4db4daf81dc96e285de9ad6620eefa03f9c81ba10ffd51844a8fa000000000e8000000002000020000000a6089e4b952a9019e11b4701eacc0d3b2c3e48ec49937b5990dff3f33aabe0fa900000005cbd1dacfc93e44ef13f92c3c08dbc4824324592732c21ffc7e232bb302dd55a715c476f14394375a82d3d8c2cf5241620b743b097a21436bdc4592a5e75b118d710686ffac94b7763fab3ac929625a0518f626ad17d4a811afeb48e1e94f04f6eeb61198f30fc30b2172a881fa819afedecc662df752b7ba8b2899b71adddf51a4e74748df335a4ab4284c1ce59ba9240000000e13dcdd79fb5d101ea17cace8481d20143452b6ec98e31fd8ed8fcebac295c86eca65ce72ddd5a51d898b613e2404963a09fd2f0763a2514aed6c54a72425140	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE39C7E1-E5EB-11EE-8ECF-42D431E39B11} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305e82b9f879da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417013042"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1664	iexplore.exe
1664	iexplore.exe
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2192	1664	iexplore.exe	28
PID 1664 wrote to memory of 2192	1664	iexplore.exe	28
PID 1664 wrote to memory of 2192	1664	iexplore.exe	28
PID 1664 wrote to memory of 2192	1664	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d61c2e5caae96b80f1feb41ddb73baa8.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
402b3cb022e2fef569c98a7f468ea2b0

SHA1
6a59acfd0f05d6ae07ae8a7c3035bd1326429ac8

SHA256
301863a91e72a63af11c41602c1e3cfc3806e120af2bc52283c406b7ce5130c3

SHA512
ce12b7df7e7ccfddfcb75c59713164fbbb30ff60967536d6ad3af25eaced60bdc9ed56cc30e43d66ce3094a71f295253ff6f26a7fea5fd4dadedbb01dfc77ce1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec9cc2fe1868a9a00489ccb77b9bdaa7

SHA1
293d7b2244b3c222701cf971a38bc743e943f2e8

SHA256
c592404868a0741d5a5f8d4a82872dcf62f7792b9479697ae7f30f44639625ff

SHA512
9aeac919be6af9108bb30243f0d5e24ca9c95366e178e1ef369a122ce36dcfadb7d38bebe60a692ac483e135a4982ac8a4422a0d20b100eeffac2504e552f1e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dfc0ca8b3419819c6885513bb7c4519

SHA1
624c688001c4e7abdbc71fb92b0220785cb8c293

SHA256
59cd03fa9de2f3884cbb925f2a6833304184cde97ef45e63817bdb903bb3e416

SHA512
221ea2343e300a56fc54b9e8c2d58fb47180674ebbc1937ad3fefdb180bddf5067bc2b23c23e751302dacc2a4cbd39c9d83f2b498377170dd3394cfa86eeb25b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75b25242a25040a3f421792349afa86c

SHA1
b70198240858eaf357bfeac0eb546f2fda4fa66d

SHA256
6a2e8be7a0d1bfc7bb1af8b7382b73472ac7614227fb931605f3c592c9a0c836

SHA512
db2afa2def4154e5ffe5c669188f7921ad384501743096a357802c6c66dd7450370b018e9ed10c4811ebaa6916ef7525983803efaecf0e326a2d33e9eaaeb88d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d16b52b77f5a599d60c21cbf19ce64e

SHA1
e277b508e2484f86e1f9d99603dd52e05d13eb97

SHA256
45092a5f9aa49f821b8cbc8ed8c200972bb996ccea98407e62ffd896d95a5edd

SHA512
7c3b8de3660e1f8cd978de30fde5ac015a075633a85e0153b57d02ba9c20c517af320c501f5f84867c1d85dfa341514ff138252654d3b6dcf0db49e5f019b336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
231c255e5579ba6f8172f2900f970d9e

SHA1
ae0d16aafcc8a7cd2e305c56e676523026a19fa0

SHA256
655e7cc13409736fd686772da969e9023d663189f31bbfbbec5fdfeeded58780

SHA512
f5689e568fd25ac9f9e91ef54b8f531a3a65d387ab79362c9b3a6a0e55e3951b19c4d7ce67da7d79a36a0fcb48dc8a817b74ba8f583ed7b56652f151bc4ec06c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c97618e7b59ffc97e37d0477c3aca40

SHA1
a36b5e354c8309e489b31042e7b6a5f69e74c5a4

SHA256
484f70213001da144dfcb40973a68a0b9806ce817175a545556f78c0b521b7e9

SHA512
e450704d3d4508ac8d2e8d691c4cfefbf3eb691c1f0b00b5e087da04a5199152d869a1a9629c785cce06c60b1157d8274a0981c13af16f1bc8639c1a69bcc80b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a010556c2bda95cd959f1f39e9502e24

SHA1
fb2f62bc93175839699cd74f8825fa0a8b890047

SHA256
08e9c068369e98aa226db9b39248e169ec955d752e6066b1bd6727265b581c0a

SHA512
60f323de41f3e0542a60dbc9cc5db53233b69a47b788fb9aa0a2d84dfbe0a301fd8f482f9231fb09ba4bc40c56c35e0085cd18840abf3141c73b42e5ef2e148f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8cb3865c2b7be16e8fca7327173a9fc

SHA1
e6da216a5a5611a9bd9752b1b08a76d93423d924

SHA256
75a14206244ac3a9d9e55011d7e0448934d6d5a4e003245ebb520525347bc936

SHA512
a71dc3f4a368a88a16cea58dcc4230ac6008e59eceb2c4ae3f751bf945e43550a07cca3397d5d6a485be6acf994e864238d26903751365ac4217d47b5f0f8fb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\errorPageStrings[2]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\httpErrorPagesScripts[1]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\sale_form[1].js

Filesize
761B

MD5
64f809e06446647e192fce8d1ec34e09

SHA1
5b7ced07da42e205067afa88615317a277a4a82c

SHA256
f52cbd664986ad7ed6e71c448e2d31d1a16463e4d9b7bca0c6be278649ccc4f3

SHA512
5f61bbe241f6b8636a487e6601f08a48bffd62549291db83c1f05f90d26751841db43357d7fe500ffba1bc19a8ab63c6d4767ba901c7eded5d65a1b443b1dd78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4E41.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4FB0.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit